System and method for software defined behavioral ddos attack mitigation

ABSTRACT

Systems and methods for software defined behavioral DDoS attack mitigation are provided. According to one embodiment, a method is provided for controlling multiple distributed denial of service (DDoS) mitigation appliances. A DDoS attack mitigation central controller configures attack mitigation policies for the DDoS attack mitigation appliances. The DDoS attack mitigation policies are sent to the DDoS attack mitigation appliances through a network connecting the DDoS attack mitigation central controller and the DDoS attack mitigation appliances.

CROSS-REFERENCE TO RELATED PATENTS

This application is a continuation of U.S. patent application Ser. No.15/396,470, filed on Dec. 31, 2016, which is a continuation of U.S.patent application Ser. No. 14/042,860, filed on Oct. 1, 2013, now U.S.Pat. No. 9,602,535, which is hereby incorporated by reference in itsentirety for all purposes.

This application also relates to U.S. Pat. No. 7,426,634 entitled,“Method and apparatus for rate based denial of service attack detectionand prevention”, U.S. Pat. No. 7,602,731 entitled “System and method forintegrated header, state, rate and content anomaly prevention withpolicy enforcement”, and U.S. Pat. No. 7,626,940 entitled “System andmethod for integrated header, state, rate and content anomaly preventionfor domain name service” all of which are hereby incorporated byreference in their entirety for all purposes. This application is alsorelated to U.S. patent application Ser. No. 13/943,085, filed Jul. 16,2013, entitled “Scalable inline behavioral DDoS attack mitigation,”which is also hereby incorporated by reference in its entirety for allpurposes.

COPYRIGHT NOTICE

Contained herein is material that is subject to copyright protection.The copyright owner has no objection to the facsimile reproduction ofthe patent disclosure by any person as it appears in the Patent andTrademark Office patent files or records, but otherwise reserves allrights to the copyright whatsoever. Copyright © 2013-2017, Fortinet,Inc.

FIELD

Embodiments of the present invention relate generally to softwaredefined networking (SDN) for distributed denial of service (DDoS)attacks.

DESCRIPTION OF THE BACKGROUND ART

Networks have been growing in complexity over the years. A typical datacenter network or an Internet Service Provider (ISP) network isextremely complex to design and manage with potentially numerousappliances deployed for management and security of such a network.

Network attacks have been simultaneously growing in complexity and sizeover the years. Among them, Distributed Denial of Service (DDoS) attacksare especially difficult to mitigate. DDoS attacks are primarily blockedusing behavioral algorithms. This requires that the appliances thatunderstand the behavior of the protected entity remain close to it.

While the inline appliances must remain close to protected entity, thecomplexity and size of the storage required for behavior data andmanagement policies increase and may be remote from central control.When the number of mitigation appliances approaches the hundreds,thousands or even more, the associated complexity may increase linearlyin relation to the number of mitigation appliances.

An innovative approach is required to facilitate decoupling andseparation of the data plane, i.e., task of behavior collection andattack mitigation using specialized DDoS attack mitigation componentsfrom the control plane, i.e., the storage of behavioral data and attackmitigation policy creation. This will allow the behavioral data andpolicies to be centrally stored and controlled while data collection,attack mitigation and packet forwarding processing remains in closeproximity to the protected entity.

SUMMARY

Innovative methods and systems are described for an integrated solutionto the distributed denial of service attacks mitigation for a largenetwork including multiple protected entities. According to oneembodiment, a method is provided for controlling multiple distributeddenial of service (DDoS) mitigation appliances. A DDoS attack mitigationcentral controller configures attack mitigation policies for the DDoSattack mitigation appliances. The DDoS attack mitigation policies aresent to the DDoS attack mitigation appliances through a networkconnecting the DDoS attack mitigation central controller and the DDoSattack mitigation appliances.

Other features of embodiments of the present disclosure will be apparentfrom accompanying drawings and from detailed description that follows.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an exemplary inline DDoS attack mitigation apparatusknown in the art. Such exemplary apparatus combines the behaviorlearning, attack mitigation, management and reporting in one appliancewhich makes this apparatus bulky. The control and data plane aretogether in this appliance.

FIG. 2 schematically shows an exemplary deployment according to thisinvention where the control and data plane have been separated.

FIG. 3 illustrates exemplary data plane components within thedecentralized DDoS attack mitigation appliances in accordance with anembodiment of the present invention.

FIG. 4 illustrates exemplary control plane components within the DDoSattack mitigation central controller in accordance with an embodiment ofthe present invention.

FIG. 5A and 5B are flow charts illustrating a process of mitigating DDoSattack by a data plane component in accordance with an embodiment of thepresent invention.

FIG. 6A and 6B are flow charts illustrating a process of controllingDDoS attack mitigation appliances by a control plane component inaccordance with an embodiment of the present invention.

DETAILED DESCRIPTION

An integrated solution is described for mitigation of Distributed Denialof Service (DDoS) attacks on a network with multiple protected entities,such as an Internet Service Provider (ISP) network, a data centernetwork or individual Internet-facing servers. According to oneembodiment, the storage of behavioral data, adaptive and continuousestimation of behavioral thresholds based on past traffic is centralizedin a DDoS attack mitigation central controller. Policies that aremanaged by the controller and controlling the decentralized mitigationcomponents are also centralized in embodiments of the present invention.The DDoS attack mitigation central controller is part of the controlplane of the integrated system.

In one embodiment, a controller which communicates with and controlsmultiple DDoS attack mitigation appliances is provided. Components ofthe controller and the appliances are described so that they cansecurely communicate with each other and provide mitigation capabilityto a large network that needs to be protected from such attacks. Thesystem can be scaled up by increasing the number of the distributedappliances and the capacity of the central controller.

Embodiments of the present invention also include a specialized butoperationally simple data collection and mitigation appliance thatinteracts with a centralized storage and policy component. Thesedecentralized appliances are part of the data plane of the integratedsystem.

Embodiments of the present invention provide a solution that separatesthe control and data plane for the DDoS attack mitigation and therebyprovides a software defined solution. Separating the control plane (intothe DDoS attack mitigation central controller) and data plane (thedecentralized mitigation appliances) leads to many benefits which willbe apparent later. One benefit of the innovative approach describedherein is that the two technologies (i.e., the data plane and controlplane functionality) can be decoupled, grow independently and remainstate of the art. In an exemplary embodiment of this invention, the dataplane may be implemented in highly specialized hardware logic using anApplication-Specific Integrated Circuit (ASIC) or Field-ProgrammableGate Arrays (FPGAs) while the control plane may use the latesttechniques in the software domain. In one embodiment, a single softwarebased controller controls multiple attack mitigation appliances via anetwork.

The size of DDoS attacks on Internet data center networks have beengrowing as more services move to large data centers in the cloud. Oneobvious solution which is the state of the art is to protect individualservers or networks with individual appliances based on their behavioralcharacteristics.

Embodiments of the new solution described herein provide a distributedarchitecture in which there is a DDoS attack mitigation centralcontroller and multiple minimalistic DDoS attack mitigation appliances.

The DDoS attack mitigation appliances specialize in the data path, i.e.,packet forwarding and attack mitigation per policies and collection ofpacket rate statistics and enforcement of behavioral thresholds. Sincepacket forwarding and policy enforcement based on behavioral thresholdsand other characteristics can be implemented in commodity hardware, in apreferred embodiment of this solution, the minimalistic DDoS appliancesmay be implemented using hardware components such as FPGAs or an ASIC.

The DDoS attack mitigation central controller on the other handspecializes in the control path, i.e., centralized data collection,threshold estimation and communication of these thresholds andcollection of attack statistics. These are software centric activitiesand can be improved as software technology improves.

Within the data plane, the DDoS attack mitigation appliance may providecopper/fiber connectivity. The appliance decides whether to drop or toallow incoming packets based on behavioral policies set by the DDoSattack mitigation central controller. The appliance determines thegranular rates and is programmed to set the granular behavioralthresholds by the central controller. The appliance also collects themitigation statistics and dispatches them to the controller for eventualdisplay to the end user or the administrator of the controller. Theappliance also provides other controls, such as access control lists,geo-location control, etc., which are well known to those of ordinaryskill in the art. In one embodiment, the DDoS attack mitigationappliance supports virtualization so that a single appliance can providedistinct policies for multiple networks.

Within the control plane, the controller collects the granular ratesfrom a plurality of DDoS attack mitigation appliances. These rates arethen used to derive the granular adaptive thresholds to be sent back tothe individual appliances for enforcement. The controller also collectsmitigation statistics from the appliances for eventual display to theend user or the administrator of the controller.

An object of various embodiments of the present invention is to providea hardware based distributed system and method of mitigating DDoSattacks, the packets having layers 2, 3, 4, and 7 rate anomalies asdetected by the host computer within the apparatus, which iscontinuously and adaptively adjusting granular layer 2, 3, 4 and 7 ratethresholds based on past base rate, trends and seasonality;

A further object of various embodiments of the present invention is toprovide a central software controller consisting of rate anomaly enginecapable of continuously calculating the traffic rate on classifiedparameters and estimating the traffic rate thresholds adaptively andthus determining the thresholds for a plurality of DDoS attackmitigation appliances. This is subsequently used to determine thegranular adaptive rate thresholds to be set on the appliances.

FIG. 1 depicts an exemplary apparatus illustrating the functionality ofa single DDoS attack mitigation appliance 100 for the mitigation of DDoSattacks in accordance with the state of the art. This component istreated as a black-box with a Host Interface being controlled bycontrolling host 111.

Inbound packets 102 enter the component 101 and exit as cleansed inboundpackets 104. Similarly, outbound packets 103 enter the component 101 andexit as cleansed outbound packets 105. The dropped packets make thedifference between packets at ingress and at egress. For the purpose offorensic analysis, these dropped packets may be routed to two forensicports viz. the dropped inbound packets 106, and the dropped outboundpackets 107.

A controlling host 111, such as a management Central Processing Unit(CPU), uses a host interface 108 to read the controlling parameters andset the parameters of different blocks via host interface 108 using abus 109, such as a Peripheral Component Interconnect Express (PCIe) bus.Controlling host 111 also periodically reads the granular traffic ratesand uses it to estimate threshold for rate parameters. Controlling host111 also reads the mitigation statistics. In some embodiments, theseevents are subsequently logged and/or analyzed. In an exemplaryembodiment, controlling host 111 can read the maximum packet rates forTransmission Control Protocol (TCP) SYN packets in two directions andset the adaptive thresholds for them through host interface 108. Inanother exemplary embodiment, controlling host 111 can read the maximumcount of concurrent connections per source in two directions and set theadaptive thresholds for them through host interface 108.

FIG. 2 schematically shows an exemplary deployment according to thisinvention where the control and data plane have been separated. In thecontext of the present example, DDoS attack mitigation centralcontroller 205 is responsible for the control plane where as theindividual appliances 201, 202, and 203 manage the data plane andprocess the packets for DDoS attack mitigation.

Each appliance 201, 202 and 203 is in the path of packets and protectingsome network from DDoS attacks. The purpose of these appliances is tocollect behavioral statistics and forward to the DDoS attack mitigationcentral controller 205 and get the behavioral policies from there andenforce them while packet forwarding.

The DDoS attack mitigation system shown in FIG. 2 consists of a centralcontroller 205 that receives behavioral data from appliances such as201, 202, and 203 and stores the behavioral data in database 206. Thisdata is used to predict behavioral thresholds which are combined withuser defined mitigation policies that are stored in database 207 andthen sent to individual appliances to enforce. The attack statisticsreceived from appliances is stored in database 208 and are available tobe displayed to the administrator for analysis.

FIG. 3 illustrates the functional components of the DDoS attackmitigation appliances such as 201, 202 and 203 according to oneembodiment of the present invention.

In an exemplary embodiment of this invention, these functionalcomponents can be implemented in hardware logic, such as in ASIC orFPGA, and made into commodity components.

One of the functions of the appliance is to expose service protectionprofiles 301. The purpose of this component is to enforce differentpolicies on different virtual networks within the protected networks. Inexemplary embodiment of this invention, the virtualization itself can beimplemented using IP address/masks, Virtual Local Area Network (VLAN)tags, Media Access Control (MAC) addresses etc. The purpose is to haveindependent policies for each of the protected profiles. This helpsbrings down the cost of the mitigation, as a single appliance canprotect multiple policies independently.

The next function of the appliance is granular traffic rate Collection302. The purpose of this component is to collect granular traffic ratesfor different protected profiles. Granularity here means layer 2, 3, 4and 7 of the network stack. In an exemplary embodiment of thisinvention, layer 2 rate collection includes rates for broadcast,multicast, Address Resolution Protocol (ARP), Reverse ARP (RAPR), VLANtagged packets, Internet Protocol (IP) packets, non-IP packets etc. Inan exemplary embodiment of this invention, layer 3 rate collectionincludes rates for multiple IP protocols, fragmented packets, variousType of Service/Differentiated Services (TOS/DS) values, etc. In anexemplary embodiment of this invention, layer 4 rate collection includesrates for one or more of TCP, User Datagram Protocol (UDP) ports,Internet Control Message Protocol (ICMP) types/codes, SYN packets, TCPconnection establishment rates values, etc. In an exemplary embodimentof this invention, layer 7 rate collection includes rates for one ormore layer 7 parameters for HyperText Transfer Protocol (HTTP), SessionInitiation Protocol (SIP), Domain Name System (DNS) and other layer 7protocols etc. These parameters are well understood in the state of theart and hence have not been described in detail here.

Yet another function of the appliance is granular behavior control 303.The purpose of this component is to enforce rate based policies atgranular levels within each protected profile. When the centralcontroller 205 sets these policies in individual appliance, thiscomponent enforces those policies. Traffic rates are controlled withinthese granular limits. In an exemplary embodiment of this invention,these rates are typically in per second basis, e.g. SYN packets/second,HTTP GET operations/second etc.

Another exemplary function of the appliance is source tracking 304. Whenthe same source breaches same behavioral rate thresholds again andagain, the offending unique source must be isolated and punished for alonger period.

According to an embodiment of this invention, yet another exemplaryfunction of the appliance is granular access control 305. These are wellunderstood ways to block sources, destinations, protocols, ports,Uniform Resource Locators (URLs), domains, geo-locations, etc.

Another exemplary function of the appliance is attack statisticsgeneration 306. When the attack packets are dropped due to attackmitigation policies or due to access control policies, these details aregenerated and centrally collected by the controller for report to theadministrators.

Since the appliances have to communicate with the controller over asecure communication link, a communication component 307 is required.This ensures authenticated and encrypted communication between theappliance and the controller.

FIG. 4 illustrates the functional components of the central controller205 according to an embodiment of the present invention.

In an exemplary embodiment of this invention, these functionalcomponents are typically implemented in software and can be enhancedover time.

According to an embodiment of this invention, one of the functions ofthe central controller is centralized policy management 401. The purposeof this component is to manage and store different policies on differentvirtual networks within the protected networks for a plurality of theDDoS attack mitigation appliances. The central controller may alsomanage such policies in a store.

According to an embodiment of this invention, another function of thecentral controller is centralized granular traffic rate storage 402. Aseach distributed DDoS attack mitigation appliance collects the granularrates, it sends it to the central controller over a secure communicationchannel. The central controller stores these in database 206.

According to an embodiment of this invention, yet another function ofthe appliance is centralized granular traffic rate estimation 403. Thecollected granular rates in the storage are used to estimate theadaptive granular rate thresholds. These adaptive thresholds arecalculated based on well known techniques in the art for trafficforecasting, such as Holtz Winter exponential smoothing. The trafficforecasts are combined with user defined policies to come up with actualgranular behavior thresholds to be communicated to the appliances.

Yet another function of the central controller is centralized attackstatistics reporting 404. The collected granular drop rates thedistributed DDoS attack mitigation appliances are stored in database208. This statistics are available to be displayed to a plurality ofadministrator of different service protection profiles based on theirauthentication and authorization.

Since the central controller has to communicate with the distributedDDoS attack mitigation appliances over a secure communication link; acommunication component 405 is required. This ensures authenticated andencrypted communication between the appliance and the centralcontroller.

Removable storage media may be attached to the host to provide and storestatistics and policies. This can be any kind of external hard-drives,floppy drives, IOMEGA® Zip Drives, Compact Dis—Read Only Memory(CD-ROM), Compact Disc—Re-Writable (CD-RW), Digital Video Disk—Read OnlyMemory (DVD-ROM).

FIG. 5A and 5B are flow charts illustrating a process of mitigating DDoSattack by a data plane component in accordance with an embodiment of thepresent invention. In the context of the present example, the data planecomponent is a minimalistic DDoS attack mitigation appliance thatremains in close proximity to a protected entity but the management ofmitigation policies is moved to a remote central controller. The centralcontroller and the DDoS attack mitigation appliances are connectedthrough a private or public network. As the control information istransferred through the network, it would be better to setup a secureconnection before any data is transferred. Therefore, at block 501, theDDoS attack mitigation appliance is authenticated with the centralcontroller and a secure connection is setup so that encrypted data maybe transferred between the two devices.

At block 502, the DDoS attack mitigation appliance receives mitigationpolicies from the central controller through the secure connection. Themitigation policies are configured by the administrator of the centralcontroller and may be adjusted based on the granular traffic rateinformation feedback to the central controller by DDoS attack mitigationappliances. The mitigation policies may include granular behavioralpacket rate thresholds and operations that a DDoS attack mitigationappliance may conduct when a DDoS attack is detected.

At block 503, the DDoS attack mitigation appliance may create serviceprotection profiles based on IP subnets, VLAN tags or MAC addresses ofsource or destination of the packets. In this embodiment, the DDoSattack mitigation appliance is used for protecting multiple entities,such as multiple computers or multiple VLANs. The DDoS attack mitigationappliance may be virtualized as multiple virtual appliances so that eachof the protected entities may have a service protection profile and thevirtual appliance may enforce different policies on different protectedentities based on the profiles. Mitigation policies for respectiveentities may be stored in the service protection profiles of therespective entities.

At block 504, the DDoS attack mitigation appliance receives inbound andoutbound packets. The DDoS attack mitigation appliance is in the path ofpackets and the packets are intercepted by the DDoS attack mitigationappliance before they are actually sent in or out of the network.

At block 505, after the packets are received, the DDoS attack mitigationappliance conducts behavioral DDos attack mitigation based on the DDoSattack mitigation policies received from the central controller. TheDDoS attack mitigation appliance may check the packet rates and the ratethresholds set in the policies. If a packet rate is over the threshold,the DDoS attack mitigation appliance may conduct the operation definedin the policies, such as drop the packets or block a source for acertain time.

At block 506, the DDoS attack mitigation appliance may collect granulartraffic rate information from the packet traffic. As the mitigationpolicies may be adjusted dynamically by the central controller based onthe packet traffic rate, the DDoS attack mitigation appliance maycollect the granular traffic rate and other traffic information andthen, send the traffic information to the central controller.

At block 507, the DDoS attack mitigation appliance may collect granularpacket drop statistics so that the administrator of the DDoS attackmitigation system may be informed of the statuses of DDoS attacks.

At block 508, the DDoS attack mitigation appliance may further trackoffending sources that exceed behavioral source packet rate thresholdsor repetitively send packets. By tracking the sources of DDoS attacks,the offending unique source may be isolated and punished for a longerperiod based on the mitigation policies.

At block 509, the DDoS attack mitigation appliance may send the granulartraffic information, packet drop statistics and/or offending sources tothe central controller so that the controller may adjust the mitigationpolicies accordingly.

FIG. 6A and 6B are flow charts illustrating a process of controllingDDoS attack mitigation appliances by a control plane component inaccordance with an embodiment of the present invention. In thisembodiment, a DDoS attack mitigation central controller is used forcontrolling multiple minimalistic DDoS attack mitigation appliances sothat the mitigation policies and other controlling functions, such aslogging, reporting, configuration or updating of the DDoS attackmitigation appliances may be managed in a central device.

At block 601, the administrator of a DDoS attack mitigation centralcontroller may configure mitigation policies for multiple DDoS attackmitigation appliances controlled by the central controller. Thesemitigation policies may include granular behavioral packet ratethresholds and operations that a DDoS attack mitigation appliance mayconduct when DDoS attacks are detected. These mitigation policies may bestored in a database or a media attached to the controller.

At block 602, one or more DDoS attack mitigation appliances areauthenticated with the central controller and secure connection(s)is/are setup between the central controller and the DDoS attackmitigation appliance(s) so that encrypted data may be transferred.

At block 603, the central controller sends mitigation policies to one ormore DDoS attack mitigation appliances through the secure connection.The DDoS attack mitigation appliances, as executing units of themitigation system, conduct DDoS attack mitigation based on the receivedpolicies and feedback traffic information and drop statistics.

At block 604, the central controller receives granular traffic rateinformation from DDoS attack mitigation appliances. The granular trafficrate information is collected by the DDoS attack mitigation appliancesin real time and feedback to the central controller so that thecontroller may adjust mitigation accordingly. It will be appreciated bya person having ordinary skill in the art that other traffic informationand/or offending sources collected by DDoS attack mitigation appliancesmay also be received by the central controller.

At block 605, the central controller estimates granular behavioralpacket rate thresholds based on the granular traffic rate informationand/or other information feedback by DDoS attack mitigation appliances.

At block 606, the central controller update mitigation policies based onthe granular behavioral packet rate thresholds and the updatedmitigation policies may be transferred to one or more DDoS attackmitigation appliances so that the DDoS attack mitigation appliances mayadjust DDoS attack mitigation based on the updated policies.

At block 607, the central controller receives granular packet dropstatistics from one or more DDoS attack mitigation appliances. Thegranular packet drop statistics and other operation information arecollected by the DDoS attack mitigation appliances in real time andfeedback to the central controller.

At block 608, the central controller reports the granular packet dropstatistics and other operation information of the DDoS attack mitigationappliances to the administrator. It is appreciated to a person skilledin the art that the statistics may be reported to the administratordirectly by the DDoS attack mitigation appliance.

Components described above are meant only to exemplify variouspossibilities. In no way should the aforementioned exemplary computersystem limit the scope of the present disclosure.

Although embodiments of the present invention and their variousadvantages have been described in detail, it should be understood thatthe present invention is not limited to or defined by what is shown ordiscussed herein.

Moreover, as one skilled in the art will appreciate, any digitalcomputer systems can be configured or otherwise programmed to implementthe methods and apparatuses disclosed herein, and to the extent that aparticular digital computer system is configured to implement themethods and apparatuses of this invention, it is within the scope andspirit of the present invention. Once a digital computer system isprogrammed to perform particular functions pursuant tocomputer-executable instructions from program software that implementsthe present invention, it in effect becomes a special purpose computerparticular to the present invention. The techniques necessary to achievethis are well known to those skilled in the art and thus are not furtherdescribed herein.

Computer executable instructions implementing the methods and techniquesof the present invention can be distributed to users on acomputer-readable medium and are often copied onto a hard disk or otherstorage medium. When such a program of instructions is to be executed,it is usually loaded into the random access memory of the computer,thereby configuring the computer to act in accordance with thetechniques disclosed herein. All these operations are well known tothose skilled in the art and thus are not further described herein. Theterm “computer-readable medium” encompasses distribution media,intermediate storage media, execution memory of a computer, and anyother medium or device capable of storing for later reading by acomputer a computer program implementing the present invention.

Accordingly, drawings, tables, and description disclosed hereinillustrate technologies related to the invention, show examples of theinvention, and provide examples of using the invention and are not to beconstrued as limiting the present invention. Known methods, techniques,or systems may be discussed without giving details, so to avoidobscuring the principles of the invention. As it will be appreciated byone of ordinary skill in the art, the present invention can beimplemented, modified, or otherwise altered without departing from theprinciples and spirit of the present invention. Therefore, the scope ofthe present invention should be determined by the following claims andtheir legal equivalents.

What is claimed is:
 1. A method for controlling a plurality ofdistributed denial of service (DDoS) mitigation appliances, comprising:decoupling control plane functionality, responsible for storage ofbehavioral data and creation of DDoS attack mitigation policies, anddata plane functionality, responsible for collection of the behavioraldata and performing DDoS attack mitigation based on the DDoS attackmitigation policies, wherein the control plane functionality isimplemented within a DDoS attack mitigation central controller andincludes adaptive, continuous estimation of behavioral thresholds basedon past traffic and management of the DDoS attack mitigation policiesand wherein the data plane functionality is implemented within anddistributed among the plurality of DDoS mitigation appliances andincludes collection of granular traffic rate information regardingtraffic observed by each of the plurality of DDoS mitigation appliances;configuring, by the DDoS attack mitigation central controller, the DDoSattack mitigation policies for the plurality of DDoS attack mitigationappliances comprising collecting, by the DDoS attack mitigation centralcontroller, the granular traffic rate information from the plurality ofDDoS attack mitigation appliances, and estimating granular behavioralpacket rate thresholds based on the granular traffic rate information;and causing, by the DDoS attack mitigation central controller, theplurality of DDoS attack mitigation appliances to enforce the granularbehavioral packet rate thresholds by sending the DDoS attack mitigationpolicies to the plurality of DDoS attack mitigation appliances through anetwork connecting the DDoS attack mitigation central controller and theplurality of DDoS attack mitigation appliances.
 2. The method of claim1, wherein the granular traffic rate information includes traffic ratesobserved during a predetermined period of time for a plurality ofpredetermined parameters of layer 2, layer 3, layer 4 or layer 7 of anetwork stack
 3. The method of claim 1, wherein said configuring, by aDDoS attack mitigation central controller, DDoS attack mitigationpolicies for the plurality of DDoS attack mitigation appliances furthercomprises: updating DDoS attack mitigation policies based on thegranular behavioral packet rate thresholds; and sending the updated DDoSattack mitigation policies to the plurality of DDoS attack mitigationappliances.
 4. The method of claim 1, wherein said configuring, by aDDoS attack mitigation central controller, DDoS attack mitigationpolicies for the plurality of DDoS attack mitigation appliances furthercomprises receiving the DDoS attack mitigation policies from anadministrator of the DDoS attack mitigation central controller through auser interface.
 5. The method of claim 1, further comprising:collecting, by the DDoS attack mitigation central controller, granularpacket drop statistics from the plurality of DDoS attack mitigationappliances; and reporting the granular packet drop statistics to theadministrator of the DDoS attack mitigation central controller.
 6. Themethod of claim 1, further comprising: establishing a secure connectionbetween the DDoS attack mitigation central controller and the pluralityof DDoS attack mitigation appliances; sending the DDoS attack mitigationpolicies through the secure connection; and receiving granular trafficrate information and granular packet drop statistics from the pluralityof DDoS attack mitigation appliances through the secure connection. 7.The method of claim 1, further comprising managing mitigation policiesin a data store by the DDoS attack mitigation central controller.
 8. Adistributed denial of service (DDoS) mitigation central controller forcontrolling a plurality of DDoS attack mitigation appliances, the DDoSmitigation central controller comprising: a non-transitory storagedevice having tangibly embodied therein instructions representing asecurity application; and one or more processors coupled to thenon-transitory storage device and operable to execute the securityapplication to perform a method comprising: configuring, by the DDoSattack mitigation central controller, DDoS attack mitigation policiesfor the plurality of DDoS attack mitigation appliances, comprisingcollecting, by the DDoS attack mitigation central controller, granulartraffic rate information and estimating granular behavioral packet ratethresholds based on the granular traffic rate information; causing, bythe DDoS attack mitigation central controller, the plurality of DDoSattack mitigation appliances to enforce the granular behavioral packetrate thresholds by sending the DDoS attack mitigation policies to theplurality of DDoS attack mitigation appliances through a networkconnecting the DDoS attack mitigation central controller and theplurality of DDoS attack mitigation appliances; wherein the DDoSmitigation central controller and the plurality of DDoS attackmitigation appliances facilitate decoupling of control planefunctionality, responsible for storage of behavioral data and creationof the DDoS attack mitigation policies, and data plane functionality,responsible for collection of the behavioral data and performing DDoSattack mitigation based on the DDoS attack mitigation policies; whereinthe control plane functionality is implemented within the DDoS attackmitigation central controller and includes adaptive, continuousestimation of behavioral thresholds based on past traffic and managementof the DDoS attack mitigation policies; and wherein the data planefunctionality is implemented within and distributed among the pluralityof DDoS mitigation appliances and includes collection of the granulartraffic rate information.
 9. The controller of claim 8, wherein thegranular traffic rate information includes traffic rates observed duringa predetermined period of time for a plurality of predeterminedparameters of layer 2, layer 3, layer 4 or layer 7 of a network stack.10. The controller of claim 8, wherein said configuring, by a DDoSattack mitigation central controller, DDoS attack mitigation policiesfor the plurality of DDoS attack mitigation appliances furthercomprises: updating DDoS attack mitigation policies based on thegranular behavioral packet rate thresholds; and sending the updated DDoSattack mitigation policies to the plurality of DDoS attack mitigationappliances.
 11. The controller of claim 8, wherein said configuring, bya DDoS attack mitigation central controller, DDoS attack mitigationpolicies for the plurality of DDoS attack mitigation appliances furthercomprises receiving the DDoS attack mitigation policies from anadministrator of the DDoS attack mitigation central controller through auser interface.
 12. The controller of claim 8, wherein the granulartraffic rate information comprises granular packet drop statistics, andwherein the method further comprises reporting the granular packet dropstatistics to the administrator of the DDoS attack mitigation centralcontroller.
 13. The controller of claim 8, wherein the method furthercomprises: establishing a secure connection between the DDoS attackmitigation central controller and the plurality of DDoS attackmitigation appliances; sending the DDoS attack mitigation policiesthrough the secure connection; and receiving granular traffic rateinformation and granular packet drop statistics from the plurality ofDDoS attack mitigation appliances through the secure connection.
 14. Thecontroller of claim 8, wherein the method further comprises managingmitigation policies in a data store by the DDoS attack mitigationcentral controller.